Exposure of Resource to Wrong Sphere in OpenClaw - #VU132748
Published: May 29, 2026
Vulnerability identifier: #VU132748
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-668
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to exposure of resource to wrong sphere in sandboxed session spawn when forwarding a sandboxed parent session into a child session prompt. A remote user can cause a child session to inherit the real workspace path to disclose sensitive information.
Only instances with the affected feature enabled and reachable are vulnerable.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.4.26